Holder
- Does
- Deposits into the register and later moves or exits the position.
- Sees
- Their own figure, and nothing about anyone else's.
- Stays hidden
- Their balance, from every other holder and from the public.
The problem, measured
The usual reply is that a public chain is pseudonymous, so an open register costs nothing. We ran a census instead of assuming: every wallet holding an active A-Pass, against every A-Token on this chain.
- 3median holders per asset
- 35/45assets with fewer than five holders
- 9assets held by exactly one wallet
- 16assets where one wallet holds 90%+
An anonymity set of 3 is not anonymity. Know the asset, watch one transfer, and you have identified the position and its size.
562 credentialed wallets enumerated on 2026-08-09. The census can miss a holder but never invent one, so each figure is a floor — the real registers are at least this exposed.
Why this does not fix itself
It is not a quiet-testnet artefact, it is the mechanism. The tighter an asset’s holder rule, the smaller the crowd its holders hide in. Eligibility restricts the population by design, so every compliant-asset design makes each remaining holder more exposed, not less.
The obvious fix — a privacy pool — destroys what made the asset legitimate. The issuer can no longer prove who holds what, cannot enforce a concentration cap, and cannot find a holder whose credential was revoked. Saksi refuses the trade-off rather than picking a side of it: private in the middle, accountable at both edges.
Three people, one register
Every screen in the console belongs to one of them. The point of the design is that what each can see is different, and none of them has to trust the others.
Issuer
- Does
- Builds the association set from live Cleanverse credentials and anchors its root on-chain.
- Sees
- Who is eligible, how many positions exist, and the total the register backs.
- Stays hidden
- Which position belongs to which holder, and every individual figure.
Regulator
- Does
- Registers a question on-chain, then waits for a proof that answers exactly it.
- Sees
- Only the answer to the question they asked — and the fact they asked first.
- Stays hidden
- Everything they did not ask about.
Entry is gated twice
Gate one is not ours
The pool is registered with Cleanverse’s own CVI Compliance Validator, and deposit() calls complianceVerify(pool, msg.sender) on their contract, live, in the transaction that moves the value. A credential frozen one block ago fails here.
Gate two is a proof
The depositor proves in zero knowledge that their key is a leaf in the association set the issuer anchored, and is absent from the sanctions list. The proof is pinned to the sender and to the exact commitment, so it is useless from another wallet.
The difference between the two is time. Holding a live credential is not membership of the set the issuer anchored, and neither gate subsumes the other — which is why both are there.
The strongest evidence is a refusal
A register that can be made to say anything proves nothing. Every audit answer here is bound to a request the regulator posted on-chain before the answer existed. One of those requests has never been answered, and cannot be:
“is total exposure across all 4 registered positions at most 1,000 SAKSIAZEV?”
no — no proof exists for this claim, so the request stays open
The claim was false, so no proof exists. The register cannot answer falsely — it can only fail to answer.
Live on Monad testnet
- Asset (SAKSIAZEV)
- 0xb9c53B57Cd47Bd3b55143647BeF8297d1C5f4d6B
- Cleanverse CVI Validator
- 0xaC7e5179C2C7f03f209136886c172eb34F161792
- Association set
- 524 members admitted
- Commitments recorded
- 12